Skip to content

Commit

Permalink
ath9k: fix tx99 use after free
Browse files Browse the repository at this point in the history
One scenario that could lead to UAF is two threads writing
simultaneously to the "tx99" debug file. One of them would
set the "start" value to true and follow to ath9k_tx99_init().
Inside the function it would set the sc->tx99_state to true
after allocating sc->tx99skb. Then, the other thread would
execute write_file_tx99() and call ath9k_tx99_deinit().
sc->tx99_state would be freed. After that, the first thread
would continue inside ath9k_tx99_init() and call
r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);
that would make use of the freed sc->tx99_skb memory.

Cc: <stable@vger.kernel.org>
Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
  • Loading branch information
Miaoqing Pan authored and Kalle Valo committed Jun 28, 2017
1 parent 57c00f2 commit cf8ce1e
Showing 1 changed file with 9 additions and 4 deletions.
13 changes: 9 additions & 4 deletions drivers/net/wireless/ath/ath9k/tx99.c
Original file line number Diff line number Diff line change
Expand Up @@ -189,22 +189,27 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf,
if (strtobool(buf, &start))
return -EINVAL;

mutex_lock(&sc->mutex);

if (start == sc->tx99_state) {
if (!start)
return count;
goto out;
ath_dbg(common, XMIT, "Resetting TX99\n");
ath9k_tx99_deinit(sc);
}

if (!start) {
ath9k_tx99_deinit(sc);
return count;
goto out;
}

r = ath9k_tx99_init(sc);
if (r)
if (r) {
mutex_unlock(&sc->mutex);
return r;

}
out:
mutex_unlock(&sc->mutex);
return count;
}

Expand Down

0 comments on commit cf8ce1e

Please sign in to comment.